dhclient(8) sets wrong interface netmask on boot up

[Warren Block]

On Sun, 13 Sep 2015, Cary wrote:

> On 09/12/2015 14:24, Warren Block wrote:
>> On Sat, 12 Sep 2015, Cary wrote:
>>> On 09/12/2015 10:45, Adam Vande More wrote:
>>>>>
>>>>> [/etc/rc.conf]
>>>>> hostname="public.fbsd.local"
>>>>> ifconfig_em0="DHCP"
>>>>> cloned_interfaces="${cloned_interfaces} lo1"
>>>>>
>>>>
>>>> previous line doesn't make much sense.
>>>>
>>>
>>> That was copied from the FreeBSD handbook section on managing jails
>>> (https://www.freebsd.org/doc/handbook/jails-ezjail.html). I didn't think
>>> that the jails would mess with the base host network configuration.
>>
>> Well, they add aliases.  The cloned_interfaces line lets the jails use a
>> separate loopback interface from the host.
>>
>>> However, after re-looking at the jail config, I changed the config line
>>> in /usr/local/etc/ezjail/www_local from:
>>>
>>> export jail_www_local_ip="lo1|127.0.1.1,em0|192.168.20.166"
>>> to
>>> export jail_www_local_ip="lo1|127.0.1.1"
>>
>> Wait, you were assigning the host's IP address to the jail?  That's the
>> problem.
>>
>
> Thanks, Warren. The jails-ezjail.html page sets up the dnsjail example
> using both the cloned loopback and the system IP (Procedure 14.1). I
> guess in that case, the system IP was static and not DHCP-assigned?

Cloned loopback is fine, "working as intended" as they say.

Jails always use static IP addresses.  If the ezjail example can be read 
as suggesting reusing the host's IP address, that needs to be fixed.

Duplicating an IP address between jail and host evidently does not cause 
quite the same problem as it would on two physical systems, but it's 
still a problem.

The jail code should check for a reused host IP address and refuse to 
start.  This would make a good bug report.  It's also possible that this 
is not checked because there is some way to actually use jails that 
share the host IP address.  If so, the right way to do that should be 
documented in the Handbook.

>> The current setup (not specifying an IP address for the jail) ends up
>> using the host's IP address again.  That also seems like a mistake, but
>> maybe not.
>
> I don't know what the default should be, but I appreciate the help in
> better understanding what is happening on the back-end.

Give each jail a unique static IP address.  If they need to respond to 
something on the host's IP address, redirect that port in a firewall.